CVE-2025-30113

The Android application accompanying the device contains authentication credentials hardcoded directly in the APK file (CWE-798 — use of hardcoded credentials). These credentials are stored in unencrypted plaintext. An attacker who gains access to the network on which the video recorder operates can read this data from the APK file and use it to connect to services listening on ports 9091 and 9092, thereby obtaining unauthorized access to the device settings.

An attacker with access to the device's network can obtain full, unauthorized access to the video recorder settings, which potentially enables modification of configuration, data reading, and compromise of the device's confidentiality, integrity, and availability.

Apply patches available from the manufacturer according to the references. As interim remedial measures, it is recommended to isolate the device from untrusted networks, implement network segmentation (e.g., dedicated Wi-Fi network for IoT devices), and restrict access to ports 9091 and 9092 at the firewall level.

Forvia Hella HELLA Driving Recorder DR 820 — firmware and Android application (APK) for this device; specific versions indicated in the manufacturer's references